🟠High: CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
-
CISA has expanded its Known Exploited Vulnerabilities (KEV) catalog with five security flaws affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. The additions follow reports that these vulnerabilities are being actively exploited in the wild, prompting the agency to flag them for urgent remediation by federal agencies and security teams.
The most severe of the group is CVE-2026-42016, an incorrect authorization flaw in JFrog Artifactory that carries a CVSS score of 8.1. This type of vulnerability typically allows an attacker to bypass intended access controls and perform actions they should not be permitted to, making it particularly dangerous in environments where Artifactory serves as a central repository for build artifacts and dependencies.
- Affected products: JFrog Artifactory, ConnectWise ScreenConnect, MikroTik RouterOS
- Notable identifier: CVE-2026-42016 (CVSS 8.1) — incorrect authorization in Artifactory
- Status: Actively exploited; added to CISA's KEV catalog
Organizations running any of these products should treat the KEV listing as a signal to prioritize patching and review their exposure. Given that all three products are widely deployed in enterprise environments, attackers have strong incentives to weaponize these flaws quickly.
Source: The Hacker News
Does your organization run any of these products, and if so, have you already started patching?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login